nix/hive-{gateway,matrix}: matrix vhost at matrix.<hive-domain> + .well-known delegation (#747)

mara on #747:9722: "this still seems to be an issue in current version"
(after #751 closed without merge). Mirroring the forge sub-domain
pattern just merged as #754 for matrix per mara's #749:9609 verdict
(sub-domain over sub-path for forge + matrix, "not user-visible for
matrix because the .well-known/matrix/{client,server} redirect routes
clients through automatically").

## Mechanics

**New `services.hyperhive.matrix.gatewayHost`** — nullable str, defaults
to `matrix.<services.hyperhive.domain>` when hive-domain set, else
null. Full hostname (`matrix.darkest.space`, `homeserver.internal.lan`)
for bespoke shapes per mara's #754:9684 "specify full domain in
options instead" pattern.

**Gateway:** new `server { server_name = matrixCfg.gatewayHost; }`
block proxying `/_matrix/...` → `http://127.0.0.1:<httpPort>/_matrix/...`
with matrix-spec CORS + tuned for long-poll `/sync` (1h timeout) +
typical media uploads (50M body cap). `/` returns 404 — nothing
else lives at the matrix vhost. Matches the forge vhost shape from #754.

**`.well-known/matrix/{client,server}`** (already served at bare hive-
domain since #660): now points at `matrixCfg.gatewayHost` (no port
suffix when gateway is on the canonical port 80) instead of the
direct `<hive-domain>:<httpPort>` shape. Falls back to direct shape
when `gatewayHost = null` (no hive-domain, or operator nulled it).

**`localHostsEntry` extension**: `/etc/hosts` (when set) now adds the
matrix sub-domain → 127.0.0.1 alongside hive-domain + forge.domain.
`lib.unique` collapses any duplicate (edge case if operator sets
gatewayHost equal to hive-domain).

## Verified via `nix eval`

```
vhosts:         ["_", "forge.test.local", "matrix.test.local"]
gatewayHost:    "matrix.test.local"
client wellknown: m.homeserver.base_url = "http://matrix.test.local"
server wellknown: m.server = "matrix.test.local"
/etc/hosts:     ["test.local", "forge.test.local", "matrix.test.local"]
```

## What this fixes for #747

mara's HAR showed `GET /.well-known/matrix/client` and
`GET /_matrix/client/versions` both failing on `pr1ma.darkest.space`:

1. **`.well-known/matrix/client`** was advertising
   `http://pr1ma.darkest.space:8008` — that URL only works if tuwunel's
   port 8008 is firewall-open to the operator's browser (it isn't by
   default — `services.hyperhive.matrix.openFirewall` defaults to false
   since #651). Now advertises `http://matrix.pr1ma.darkest.space/`
   which goes through the gateway on the (already-open) port 80.

2. **`/_matrix/client/versions`** was hitting the bare-domain `"_"`
   vhost, which has no `/_matrix/` location — fell through to `/` →
   c0re's dashboard upstream → 404. Now hits the new `matrix.<hive>`
   vhost which proxies the request to tuwunel cleanly.

server_name + serverName unaffected — matrix identifiers (`@alice:<hive>`)
still embed the bare hive-domain per #660; only the wire-level transport
URL moves to the sub-domain.

## Risk

Medium. Existing matrix tokens / sessions stay valid because:
- `serverName` (the identifier domain) doesn't change
- tuwunel's `/_matrix/` endpoints serve the same requests, just reached
  via the new sub-domain instead of the direct port

Operators with `services.hyperhive.matrix.openFirewall = true` and
external clients reaching `:8008` directly keep working too — the
sub-domain vhost is additive, doesn't take away the direct port.

## Sequencing

This is a parallel matrix-side mirror of #754 (forge). Both follow
the same mara-verdict pattern; once both have soaked, the gateway-
behind-everything story is done for v0.

Closes #747.

nix/modules/hive-matrix.nix

@@ -252,6 +252,50 @@ in
       '';
     };
 
+    gatewayHost = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = if hyperhiveDomain != null then "matrix.${hyperhiveDomain}" else null;
+      defaultText = lib.literalExpression ''
+        if services.hyperhive.domain != null then
+          "matrix.''${services.hyperhive.domain}"
+        else
+          null
+      '';
+      example = "matrix.example.com";
+      description = ''
+        Public hostname for the matrix homeserver behind the
+        hive-gateway nginx (#747, mara verdict on #749:9609 — sub-domain
+        over sub-path for matrix, but **not user-visible** because the
+        `.well-known/matrix/{client,server}` redirect routes clients
+        through automatically).
+
+        When set + gateway is on, the gateway adds a `server { server_name
+        = gatewayHost; }` block that proxies `/_matrix/...` →
+        `http://127.0.0.1:''${httpPort}/_matrix/...`. The
+        `.well-known/matrix/{client,server}` endpoints (served by the
+        gateway at the bare hive-domain) then point at
+        `http(s)://''${gatewayHost}/` — matrix clients automatically
+        discover + follow that delegation.
+
+        Defaults to `matrix.''${services.hyperhive.domain}` when the
+        hive-domain is set (idiomatic matrix-spec shape — `matrix`
+        labelled under the hive's bare server_name domain). Defaults to
+        `null` when the hive-domain is unset (gateway vhost not added;
+        clients reach tuwunel directly on `httpPort`).
+
+        Set to a full hostname (`matrix.example.com`,
+        `homeserver.internal.lan`) for a bespoke vhost shape. Set to
+        `null` to disable the gateway vhost entirely (tuwunel stays
+        direct on `httpPort`).
+
+        **server_name vs gatewayHost**: `serverName` is the matrix
+        identifier domain embedded in user/room IDs irrevocably (per
+        #660 default = bare hive-domain). `gatewayHost` is just where
+        the API listens behind nginx. The two are different — see the
+        matrix-spec server-discovery flow.
+      '';
+    };
+
     openFirewall = lib.mkOption {
       type = lib.types.bool;
       default = false;